CVE-2026-15128: Chrome Forms UXSS Vulnerability - Patch to 150.0.7871.115

Technical summary

CVE-2026-15128 is a Universal XSS (UXSS) vulnerability in Chrome's Forms implementation. The root cause is an inappropriate implementation that fails to properly validate or sanitize user-controlled input in form-related contexts. An unauthenticated remote attacker can craft malicious HTML that, when rendered by a vulnerable Chrome instance, executes arbitrary JavaScript in the origin context of any page, potentially compromising session tokens, cookies, or sensitive DOM data. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). Chromium's security team rated this as High severity internally, though the CVSS 3.1 score of 6.1 reflects a medium baseline due to the requirement for user interaction and limited direct impact scope.

Business impact

This vulnerability poses a moderate but meaningful risk to browser-based workflows. While it requires user interaction (visiting a malicious link), the attack surface is broad: phishing campaigns, compromised advertisements, or social engineering can deliver the payload to large populations. Once exploited, attackers can steal authentication credentials, session tokens, or sensitive data from any website the user is logged into. Organizations with heavy reliance on web applications—especially those handling financial transactions, healthcare records, or proprietary information—should treat this as a priority. The impact escalates if users work across multiple sensitive web portals or if your environment has limited email filtering.

Affected systems

Google Chrome versions prior to 150.0.7871.115 are vulnerable. This includes all Chromium-based browsers that track upstream Chrome (Edge, Brave, Opera, etc.) until they receive corresponding patches. Organizations running older Chrome releases or with delayed patching cycles are at risk. Desktop, mobile, and ChromeOS instances are potentially affected. Verify your current Chrome version by navigating to chrome://settings/help.

Exploitability

Exploitation requires user interaction—the victim must visit a crafted webpage or click a malicious link. No special privileges, authentication, or system-level access is needed from the attacker's perspective. The barrier to weaponization is low: a simple HTML page triggers the vulnerability. However, the attack is not wormable or self-propagating. Real-world exploitation likelihood is moderate to high given the simplicity of delivery and the prevalence of phishing and social engineering. As of the published date, this CVE is not tracked in CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting either no public exploit disclosure or minimal active exploitation at the time of publication.

Remediation

Update Google Chrome to version 150.0.7871.115 or later immediately. Chrome's auto-update mechanism will typically deliver this patch within days of release; verify completion via chrome://settings/help. Users on Chromium-derived browsers (Edge, Brave, Opera) should check for corresponding patches from those vendors. In parallel, implement or reinforce email security controls to reduce phishing delivery vectors, and consider educating users about suspicious links. Organizations should avoid relying solely on user behavior—assume users will click untrusted links and layer defenses accordingly.

Patch guidance

Google has released Chrome 150.0.7871.115 and later to address this flaw. Deployment should be prioritized for devices handling sensitive web-based workflows. Verify patching completion via chrome://version or Enterprise reporting tools. For large organizations, validate that auto-update is enabled and functional, or use Chrome Enterprise policy to enforce updates. Test critical web applications in the patched environment before full rollout to rule out compatibility regressions. Chromium-based browsers (Microsoft Edge, Brave, Opera) will receive patches aligned with their release schedules; cross-check vendor advisories for specific versions.

Detection guidance

Detection at the network or endpoint level is challenging because the attack involves benign HTTP traffic to a crafted page. Focus detection efforts on behavioral indicators: monitor for unusual JavaScript execution within browser contexts, suspicious DOM manipulation, or abnormal access to sensitive cookies or local storage. Browser security event logs may capture XSS-related warnings if Enhanced Safe Browsing is enabled. Email and web gateway logs should flag links to known malicious domains. For a more proactive approach, maintain an inventory of Chrome versions across your fleet and alert on instances running versions below 150.0.7871.115. Endpoint Detection and Response (EDR) tools with behavioral analysis may flag post-exploitation activity (e.g., credential theft or lateral movement) triggered by the injected script.

Why prioritize this

This vulnerability merits urgent but not critical prioritization. The CVSS 6.1 (medium) score reflects the user-interaction requirement, but the broad attack surface (any user on any website), ease of exploitation, and potential for credential theft justify faster patching than many medium-risk issues. Prioritize updates for systems where users access high-value web applications (email, SaaS business tools, financial platforms). Given that Chrome's auto-update typically handles this transparently, the blocking factor is usually organizational policy or legacy systems pinned to older releases. Address those exceptions promptly.

Risk score, explained

The CVSS 3.1 score of 6.1 (medium) balances several factors: High attack vector (network, no special network access needed), Low attack complexity (simple crafted HTML), No privileges required, User interaction required (raises bar slightly), and Scope change (injected script affects multiple origins). The integrity and confidentiality impacts are rated as Low because the attack can steal or modify sensitive data but does not directly compromise the underlying system or cause denial of service. The score appropriately reflects that this is a serious web-based vulnerability but not a system-level compromise. Chromium's internal "High" severity rating acknowledges the practical exploitability and breadth of impact; the CVSS baseline is more conservative due to the interaction requirement.

Frequently asked questions